<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>Linux系统日志 | 失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		<article>
	
		<h1>Linux系统日志</h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/Linux/">Linux</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;日志重要吗？必须的，没有日志我们怎么知道系统状况？没有日志如何排查一个trouble？日志记录了系统每天发生的各种各样的事情，你可以通过他来检查错误发生的原因，或者受到攻击时攻击者留下的痕迹。日志主要的功能有：审计和监测，还可以实时的监测系统状态，监测和追踪侵入者等等。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;配置文件 <code>/etc/rsyslog.conf</code>  。CentOS默认改为 <code>rsyslog.conf</code> 之前版本是 <code>syslog.conf</code> 。该配置文件主要信息为：记录哪些服务和需要记录什么等级的信息。</p>
<h2 id="日志格式："><a href="#日志格式：" class="headerlink" title="日志格式："></a>日志格式：</h2><ul>
<li><p>auth            -pam生产的日志          </p>
</li>
<li><p>authpriv       -ssh，ftp 等登录信息的验证信息       </p>
</li>
<li><p>cron             -时间任务相关</p>
</li>
<li><p>kern             -内核</p>
</li>
<li><p>lpr                -打印</p>
</li>
<li><p>mail              -邮件</p>
</li>
<li><p>mark(syslog) -rsyslog服务内部的信息，时间标识</p>
</li>
<li><p>news             -新闻组</p>
</li>
<li><p>user              -用户程序产生的相关信息</p>
</li>
<li><p>uucp             -unix to unix copy，unix主机之间相关的通讯</p>
</li>
<li><p>local 1~7       -自定义的日志设备</p>
</li>
</ul>
<h2 id="日志级别："><a href="#日志级别：" class="headerlink" title="日志级别："></a>日志级别：</h2><ul>
<li><p>debug            -有调试信息的，日志信息最多  </p>
</li>
<li><p>info                -一般信息的日志，最常用</p>
</li>
<li><p>notice             -最具有重要性的普通条件的信息</p>
</li>
<li><p>warning           -警告级别</p>
</li>
<li><p>err                   -错误级别，阻止某个功能或者模块不能正常工作的信息</p>
</li>
<li><p>crit                   -严重级别，阻止整个系统或者整个软件不能正常工作的信息</p>
</li>
<li><p>alert                 -需要立刻修改的信息</p>
</li>
<li><p>emerg               -内核崩溃严重信息</p>
</li>
<li><p>none                  -什么都不记录</p>
</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;从上到下，级别从低到高，记录的信息越来越少</p>
<h2 id="连接符号："><a href="#连接符号：" class="headerlink" title="连接符号："></a>连接符号：</h2><ul>
<li><p><code>.:</code>    表示大于等于xxx 级别的信息</p>
</li>
<li><p><code>.=:</code>  表示等于xxx 级别的信息</p>
</li>
<li><p><code>.!:</code>   表示在xxx 之外的等级的信息</p>
</li>
</ul>
<h2 id="var-log-messages-核心系统日志文件"><a href="#var-log-messages-核心系统日志文件" class="headerlink" title="/var/log/messages 核心系统日志文件"></a>/var/log/messages 核心系统日志文件</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这个日志是linux 系统最核心的日志文件，假若某个服务没有定义日志，那么该服务产生的日志就会到这个文件中。该日志每周归档一次。它是核心系统日志文件，包含了系统启动时的引导消息，以及系统运行时的其他状态消息。IO错误、网络错误和其他系统错误都会记录到这个文件中。另外其他信息，比如某个人的身份切换为root以及用户自定义安装的软件（apache）的日志也会在这里列出。通常，/var/log/messages是在做故障诊断时首先要查看的文件。系统有一个日志轮询的机制，每星期切换一个日志，变成message.xxxxxxxx, message.xxxxxxxx, … messages.xxxxxxxx 连同messages一共有5个这样的日志文件。这里的xxxxxxxx就是按照日期的格式生成的文件，在CentOS5里，这个后缀并不是日期而是数字1,2,3,4. 这是通过logrotate工具的控制来实现的</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ls /var/log/messages*</span></div><div class="line">/var/<span class="built_in">log</span>/messages /var/<span class="built_in">log</span>/messages-20161016.1 /var/<span class="built_in">log</span>/messages-20161120</div><div class="line">/var/<span class="built_in">log</span>/messages-20161010.1 /var/<span class="built_in">log</span>/messages-20161016.bak /var/<span class="built_in">log</span>/messages-20161129</div><div class="line">/var/<span class="built_in">log</span>/messages-20161010.bak /var/<span class="built_in">log</span>/messages-20161114 /var/<span class="built_in">log</span>/messages-20161204</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;它的配置文件是/etc/logrotate.conf如果没有特殊需求请不要修改这个配置文件。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># cat /etc/logrotate.conf</span></div><div class="line"><span class="comment"># see "man logrotate" for details</span></div><div class="line"><span class="comment"># rotate log files weekly</span></div><div class="line">weekly</div><div class="line"> </div><div class="line"><span class="comment"># keep 4 weeks worth of backlogs</span></div><div class="line">rotate 4</div><div class="line"> </div><div class="line"><span class="comment"># create new (empty) log files after rotating old ones</span></div><div class="line">create</div><div class="line"> </div><div class="line"><span class="comment"># use date as a suffix of the rotated file</span></div><div class="line">dateext</div><div class="line"> </div><div class="line"><span class="comment"># uncomment this if you want your log files compressed</span></div><div class="line"><span class="comment">#compress</span></div><div class="line"> </div><div class="line"><span class="comment"># RPM packages drop log rotation information into this directory</span></div><div class="line">include /etc/logrotate.d</div><div class="line"> </div><div class="line"><span class="comment"># no packages own wtmp and btmp -- we'll rotate them here</span></div><div class="line">/var/<span class="built_in">log</span>/wtmp &#123;</div><div class="line"> monthly</div><div class="line"> create 0664 root utmp</div><div class="line"> minsize 1M</div><div class="line"> rotate 1</div><div class="line">&#125;</div><div class="line"> </div><div class="line">/var/<span class="built_in">log</span>/btmp &#123;</div><div class="line"> missingok</div><div class="line"> monthly</div><div class="line"> create 0600 root utmp</div><div class="line"> rotate 1</div><div class="line">&#125;</div><div class="line"> </div><div class="line"><span class="comment"># system-specific logs may be also be configured here.</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;/var/log/messages是由syslogd这个守护进程产生的，如果停掉这个服务则系统不会产生/var/log/messages，所以这个服务不要停。Syslogd服务的配置文件为/etc/syslog.conf这个文件定义了日志的级别，若没有特殊需求是不需要修改这个配置文件的，使用 <code>man syslog.conf</code> 获得更多关于它的信息。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;除了关注/var/log/messages外，还应该多关注一下 dmesg 这个命令，它可以显示系统的启动信息，如果某个硬件有问题（比如说网卡）用这个命令也是可以看到的。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># dmesg |less</span></div><div class="line">Initializing cgroup subsys cpuset</div><div class="line">Initializing cgroup subsys cpu</div><div class="line">Linux version 2.6.32-220.el6.x86_64 (mockbuild@c6b18n3.bsys.dev.centos.org)</div><div class="line">(gcc version 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) ) <span class="comment">#1 SMP Tue Dec 6</span></div><div class="line">19:48:22 GMT 2011</div><div class="line">Command line: ro root=UUID=7912412b-3e66-401d-9ef5-3c2aba8dc737 rd_NO_LUKS</div><div class="line">KEYBOARDTYPE=pc KEYTABLE=us rd_NO_MD quiet rhgb crashkernel=auto</div><div class="line">LANG=zh_CN.UTF-8 rd_NO_LVM rd_NO_DM</div><div class="line">KERNEL supported cpus:</div><div class="line">  Intel GenuineIntel</div><div class="line">  AMD AuthenticAMD</div><div class="line">  Centaur CentaurHauls</div><div class="line">BIOS-provided physical RAM map:</div><div class="line">BIOS-e820: 0000000000000000 - 000000000009a400 (usable)</div><div class="line">BIOS-e820: 000000000009a400 - 00000000000a0000 (reserved)</div><div class="line">BIOS-e820: 00000000000d2000 - 00000000000d4000 (reserved)</div><div class="line">BIOS-e820: 00000000000e4000 - 0000000000100000 (reserved)</div><div class="line">BIOS-e820: 0000000000100000 - 00000000cff60000 (usable)</div><div class="line">BIOS-e820: 00000000cff60000 - 00000000cff69000 (ACPI data)</div></pre></td></tr></table></figure>
<h2 id="命令：last"><a href="#命令：last" class="headerlink" title="命令：last"></a>命令：last</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># last |head</span></div><div class="line">root pts/0 192.168.0.207 Wed Jun 12 20:28 still logged <span class="keyword">in</span></div><div class="line">root pts/1 192.168.0.207 Wed Jun 12 20:27 still logged <span class="keyword">in</span></div><div class="line">root pts/0 192.168.0.161 Wed Jun 12 14:36 - 20:27 (05:50)</div><div class="line">root pts/0 192.168.0.161 Wed Jun 12 14:36 - 14:36 (00:00)</div><div class="line">root pts/0 192.168.0.207 Wed Jun 12 11:42 - 14:36 (02:54)</div><div class="line">root pts/0 192.168.0.207 Mon Jun 10 12:23 - 14:23 (02:00)</div><div class="line">root pts/0 192.168.0.70 Sat Jun 8 16:43 - 17:53 (01:09)</div><div class="line">root pts/0 192.168.0.70 Fri Jun 7 16:43 - 17:27 (00:44)</div><div class="line">root pts/0 192.168.0.70 Fri Jun 7 09:57 - 16:09 (06:11)</div><div class="line">root pts/0 192.168.0.70 Thu Jun 6 13:40 - 17:50 (04:09)</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;last命令用来查看登录Linux历史信息，从左至右依次为账户名称、登录终端、登录客户端ip、登录日期及时长。last命令输出的信息实际上是读取了二进制日志文件/var/log/wtmp, 只是这个文件不能直接使用cat, vim, head, tail等工具查看。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;另外一个和登陆信息有关的日志文件为/var/log/secure, 该日志文件记录验证和授权等方面的信息，比如ssh登陆系统成功或者失败，都会把相关信息记录在这个日志里。</p>
<ul>
<li><p>/var/log/wtmp日志用来查看用户登录历史，但这个文件不能直接cat查看，只能用last命令查看。</p>
</li>
<li><p>/var/log/btmp日志和wtmp类似，也不能直接cat查看，用命令lastb查看，记录无效登录历史。</p>
</li>
<li><p>/var/log/maillog是用来记录邮件相关的信息，比如发给谁邮件，是否发出去等信息。</p>
</li>
<li><p>/var/log/secure是一个安全认证相关的日志，比如系统用户登录时，正常登录或者登录失败都会记录，另外ftp服务相关的登录日志也会记录到这里来。</p>
</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;dmesg这是一个命令，主要查看系统实时的硬件设备抛出的信息，如果磁盘异常或者网络异常或者内核异常都会记录下来。只不过这些信息是存到内存里的，系统重启后就消失了。</p>

	

	
		<span class="different-posts"><a href="/2017/10/12/1. Linux 基础/65. Linux系统日志/" onclick="window.history.go(-1); return false;">⬅️ Go back </a></span>

	

</article>

	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
